MISP
/
misp-warninglists
mirror of https://github.com/MISP/misp-warninglists
2
0
Fork 0
Code Issues Releases Wiki Activity
misp-warninglists/lists/sinkholes/list.json

120 lines
2.4 KiB
JSON
Raw Normal View History

chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
{
"description": "List of known sinkholes",
"list": [
"104.155.11.149",
New sinkhole hosts reported from riskrecon.com
2021-12-13 18:52:01 +01:00
"104.21.27.14",
Add new sinkholes from riskrecon.com
2022-05-31 18:24:51 +02:00
"104.21.65.18",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"104.244.12.0/22",
"106.187.96.49",
"109.74.196.143",
New sinkhole hosts reported from riskrecon.com
2021-12-13 18:52:01 +01:00
"128.14.246.28",
Add new sinkholes from riskrecon
2022-06-20 18:11:36 +02:00
"13.107.213.69",
"13.107.219.35",
"13.107.246.57",
"13.107.246.69",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"131.253.18.11",
"131.253.18.12",
chg: Add script to make lists unique, and sort the keys. Update covid lists.
2020-04-03 13:37:17 +02:00
"136.161.101.53",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"139.146.167.25",
"142.0.36.234",
"143.215.130.0/24",
"144.217.254.3",
"144.217.74.156",
"146.112.61.104",
"146.112.61.105",
"146.112.61.106",
"146.112.61.107",
"146.112.61.108",
"146.112.61.109",
"146.112.61.110",
Combine cert.pl range, a significant number of these IPs revese lookup to sinkhole.cert.pl.
2021-11-17 22:42:33 +01:00
"148.81.111.0/25",
New sinkhole hosts reported from riskrecon.com
2021-12-13 18:52:01 +01:00
"151.139.128.11",
add sinkhole IP https://dns.google.com/query?name=sinkhole.dynu.net https://dns.google.com/query?name=a.sinkhole.yourtrap.com&type=A&dnssec=true
2019-11-12 22:15:51 +01:00
"153.234.210.49",
New sinkholes detected from work with riskrecon.com and other security sites. Running curl on any of these IPs pretty well shows they are sinkholes
2021-10-27 19:45:45 +02:00
"162.222.213.197",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"166.78.144.80",
"168.181.184.35",
New sinkholes detected from work with riskrecon.com and other security sites. Running curl on any of these IPs pretty well shows they are sinkholes
2021-10-27 19:45:45 +02:00
"168.62.217.117",
New sinkholes from riskrecon
2022-05-09 21:36:31 +02:00
"172.67.139.94",
"172.67.223.134",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"173.192.192.10",
This range all has reverse DNS lookup info pointing to sinkholed.by.zinkhole.org.
2021-11-17 22:46:58 +01:00
"176.31.62.76/30",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"176.58.104.168",
New sinkholes detected from work with riskrecon.com and other security sites. Running curl on any of these IPs pretty well shows they are sinkholes
2021-10-27 19:45:45 +02:00
"178.162.203.202",
"178.162.203.226",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"178.32.140.251",
"178.79.190.156",
Add additional Sinkhole IPs https://github.com/brakmic/Sinkholes/pull/10/files https://github.com/brakmic/Sinkholes/pull/12/files https://github.com/grettir/malware-sinkholes/pull/2/files
2019-11-08 07:43:53 +01:00
"183.236.2.18",
Reverse looking up all these addresses in this range mention sinkhole
2021-11-17 21:50:05 +01:00
"184.105.192.0/29",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"192.169.69.25",
Reverse lookup of this IP shows sinkhole.hyas.com.
2021-11-17 22:50:10 +01:00
"192.169.69.26",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"192.42.116.41",
sinkhole.fitsec.com revese DNS
2021-11-17 22:54:58 +01:00
"193.166.255.170",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"193.166.255.171",
"195.22.26.192/26",
"198.61.227.6",
"198.98.120.157",
"199.2.137.0/24",
"199.231.211.108",
"204.95.99.59",
Add additional Sinkhole IPs https://github.com/brakmic/Sinkholes/pull/10/files https://github.com/brakmic/Sinkholes/pull/12/files https://github.com/grettir/malware-sinkholes/pull/2/files
2019-11-08 07:43:53 +01:00
"206.189.61.126",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"207.46.90.0/24",
Combine common range also including 208.100.26.238 from securityscorecard
2022-09-19 18:02:22 +02:00
"208.100.26.224/27",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"208.43.245.213",
"212.227.20.19",
"212.227.55.84",
New sinkholes detected from work with riskrecon.com and other security sites. Running curl on any of these IPs pretty well shows they are sinkholes
2021-10-27 19:45:45 +02:00
"216.218.135.114",
"216.218.185.162",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"217.182.172.139",
"23.253.126.58",
"23.253.46.64",
New sinkhole hosts reported from riskrecon.com
2021-12-13 18:52:01 +01:00
"3.14.206.87",
"34.192.238.26",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"38.102.150.29",
Two more sinkholes from bitsight.com that are in use
2021-12-02 18:28:09 +01:00
"38.229.128.125",
"38.229.148.43",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"38.229.70.125",
Fix order
2021-10-28 00:09:36 +02:00
"5.79.71.205",
"5.79.71.225",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"50.116.32.177",
"50.116.56.144",
"50.57.148.87",
New sinkholes from riskrecon
2022-05-09 21:36:31 +02:00
"52.15.119.124",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"52.5.245.208",
Add additional Sinkhole IPs https://github.com/brakmic/Sinkholes/pull/10/files https://github.com/brakmic/Sinkholes/pull/12/files https://github.com/grettir/malware-sinkholes/pull/2/files
2019-11-08 07:43:53 +01:00
"58.158.177.102",
New sinkholes detected from work with riskrecon.com and other security sites. Running curl on any of these IPs pretty well shows they are sinkholes
2021-10-27 19:45:45 +02:00
"64.71.166.50",
5 of the hosts in this range are also shadowserver sinkholes according to their reverse DNS
2021-11-17 21:56:17 +01:00
"66.220.23.112/29",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"67.215.255.139",
"74.200.48.169",
"74.208.15.160",
"74.208.15.97",
"74.208.164.166",
"74.208.64.145",
"74.208.64.191",
"79.137.66.14",
"81.166.122.234",
"86.124.164.25",
"87.106.140.254",
"87.106.141.15",
Another sinkhole acquired from abuseat.com
2022-02-28 20:31:20 +01:00
"87.106.18.122",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"87.106.24.200",
chg: Add script to make lists unique, and sort the keys. Update covid lists.
2020-04-03 13:37:17 +02:00
"87.106.240.162",
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
"87.106.250.34",
"87.106.26.9",
"87.106.86.28",
"87.255.51.229",
"91.186.66.36",
"91.233.244.106",
"93.159.228.22",
"94.23.175.2",
"95.211.172.143",
"95.211.174.92"
chg: Add script to make lists unique, and sort the keys. Update covid lists.
2020-04-03 13:37:17 +02:00
],
"matching_attributes": [
"ip-src",
"ip-dst"
],
"name": "List of known sinkholes",
"type": "cidr",
"version": 1
chg: [sinkholes] added
2018-09-26 22:56:47 +02:00
}